package com.cy.jt.security.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //super.configure(http);
        //1. 关闭跨域攻击
        http.csrf().disable();
        //2. 配置登录URL
        http.formLogin().loginPage("/login.html")
                .defaultSuccessUrl("/login")
                //.usernameParameter("username")//匹配字段
                .successForwardUrl("/index.html");
                //.failureForwardUrl("/login.html");
        //3. 登录URL(不需要认证就可以访问)
        http.authorizeRequests()
                .antMatchers("/login.html")
                .permitAll()//允许直接访问
                .anyRequest().authenticated();//除了以上资源必须认证才可访问
    }

    /**
     * @return
     * @Bean --@Configuration
     */
    @Bean//默认为方法名 passwordEncoder
    //@Bean("bcryptPasswordEncoder")//自定义bean名字
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}
